The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Review the following sections in this chapter for information about upgrading to the latest Cisco APIC-EM version and verification.
The GUI upgrade procedure requires that you perform the following tasks:
Download the release upgrade pack from the secure Cisco website at the Download Software link.
Run a checksum against the release upgrade pack.
Upload the release upgrade pack to the controller using the GUI.
Update the controller's software with the release upgrade pack using the GUI.
Note | In a multi-host cluster, when you begin the update process on a single host it triggers the update process on all the other hosts in the cluster. When the update process is finished, all the hosts in the cluster will have the same configuration. If you are updating a multi-host cluster with the latest software release (1.2.0.x) and also want to configure IPSec tunneling between the hosts, then follow this procedure: Upgrading to Cisco APIC-EM, Release 1.2.0.x and Enabling IPSec for a Multi-Host Cluster. |
You must have successfully deployed the Cisco APIC-EM and it must be operational.
You must have received notification from Cisco that the Cisco APIC-EM software upgrade is available to download from the secure Cisco website.
You must have administrator (ROLE_ADMIN) permissions to perform this procedure.
For information about the user permissions required to perform tasks using the Cisco APIC-EM, see the chapter, Managing Users and Roles in the Cisco Application Policy Infrastructure Controller Enterprise Module Configuration Guide.
This procedure should be read with the latest version of the Cisco APIC-EM release notes, as there may be specific additional requirements for that release's upgrade. The latest release for Cisco APIC-EM is release 1.2.0.x. If you are upgrading to this version, then you should first review the Release Notes for Cisco Application Policy Infrastructure Controller Enterprise Module, Release 1.2.0.x before beginning this procedure.
Step 1 | Review the
information in the Cisco notification about the
Cisco APIC-EM
upgrade.
The Cisco notification specifies the location of the release upgrade pack and verification values for either a Message Digest 5 (MD5) or Secure Hash Algorithm (SHA) 512 bits (SHA512) checksum.
| ||
Step 2 | Download the
Cisco APIC-EM
upgrade package from the Cisco website at the
Download Software link.
The release upgrade pack is available for download as a tar file that is also compressed, so the release upgrade pack has a .tar.gz extension. The release upgrade pack itself may consist of any or all of the following update files:
| ||
Step 3 | Run a checksum against the file using your own checksum verification tool or utility (either MD5 or SHA512). | ||
Step 4 | Review the
displayed checksum verification value from your checksum verification tool or
utility.
If the output from your checksum verification tool or utility matches the appropriate checksum value in the Cisco notification or from the Cisco secure website, then proceed to the next step. If the output does not match the checksum value, then download the release upgrade pack and perform another checksum. If checksum verification issues persist, contact Cisco support. | ||
Step 5 | Upload the
upgrade package to the controller using the
Software
Update functionality of the GUI.
For additional information about this step, see the Cisco Application Policy Infrastructure Controller Enterprise Module Deployment Guide. | ||
Step 6 | Update the
controller's software with the upgrade package using the
Software
Update functionality of the GUI.
For additional information about this step, see the Cisco Application Policy Infrastructure Controller Enterprise Module Deployment Guide. | ||
Step 7 | Check the
controller’s software version number in the GUI
Home window. The GUI
Home window should display the new software version.
|
Verify the upgrade process, see Verifying the Upgrade Process.
The CLI upgrade procedure requires that you perform the following tasks:
Download the release upgrade pack (.tar.gz file) from the secure Cisco website at the Download Software link.
Run a checksum against the file.
Save the file to a location on your appliance, server, or virtual machine.
Run the Grapevine upgrade command on the file.
Note | In a multi-host cluster, when you begin the update process on a single host it triggers the update process on all the other hosts in the cluster. When the update process is finished, all the hosts in the cluster will have the same configuration. If you are updating a multi-host cluster with the latest software release (1.2.0.x) and also want to configure IPSec tunneling between the hosts, then follow this procedure: Upgrading to Cisco APIC-EM, Release 1.2.0.x and Enabling IPSec for a Multi-Host Cluster. |
You must have successfully deployed the Cisco APIC-EM and it must be operational.
You must have received notification from Cisco that the Cisco APIC-EM software upgrade is available to download from the secure Cisco website.
You must have administrator (ROLE_ADMIN) permissions to perform this procedure.
For information about the user permissions required to perform tasks using the Cisco APIC-EM, see the chapter, Managing Users and Roles in the Cisco Application Policy Infrastructure Controller Enterprise Module Configuration Guide.
This procedure should be read with the latest version of the Cisco APIC-EM release notes, as there may be specific additional requirements for that release's upgrade. The latest release for Cisco APIC-EM is release 1.2.0.x. If you are upgrading to this version, then you should first review the Release Notes for Cisco Application Policy Infrastructure Controller Enterprise Module, Release 1.2.0.x before beginning this procedure.
Step 1 | Review the
information in the Cisco notification about the
Cisco APIC-EM
upgrade.
The Cisco notification specifies the location of the release upgrade pack and verification values for either a Message Digest 5 (MD5) or Secure Hash Algorithm (SHA) 512 bits (SHA512) checksum.
| ||||
Step 2 | Download the
Cisco APIC-EM
upgrade package from the Cisco website at the
Download Software link.
The release upgrade pack is available for download as a tar file that is also compressed, so the release upgrade pack has a .tar.gz extension. The release upgrade pack itself may consist of any or all of the following update files:
| ||||
Step 3 | Run a checksum against the file using your own checksum verification tool or utility (either MD5 or SHA512). | ||||
Step 4 | Review the
displayed checksum verification value from your checksum verification tool or
utility.
If the output from your checksum verification tool or utility matches the appropriate checksum value in the Cisco notification or from the Cisco secure website, then proceed to the next step. If the output does not match the checksum value, then download the release upgrade pack and perform another checksum. If checksum verification issues persist, contact Cisco support. | ||||
Step 5 | Copy or move the file from your laptop or secure network location to the appliance, server, or virtual machine with the controller. | ||||
Step 6 | Using a Secure Shell (SSH) client, log into the host (appliance, server or virtual machine) with the IP address that you specified using the configuration wizard. | ||||
Step 7 | When prompted, enter your Linux username ('grapevine') and password for SSH access. | ||||
Step 8 | Navigate to the
folder where the file is located and run the following command:
$ grape update upload [path-to-upgrade-package] The grape update upload command will proceed to upgrade (upload and then update) the controller with the file. You should refrain from working with the controller during the entire upgrade process. During the upgrade process, the controller may shut down and restart. The shut down process may last for several minutes. A percentage bar will appear to show the upload progress. Once the upload process completes, you will receive notification of its completion and of the beginning of the update process. Release upgrade package uploaded successfully, Update process started. task_id: 8507f3f6-1de2-11e6-bf7e-00505695af10
| ||||
Step 9 | Once the
upgrade process finishes (upload and update), you will receive a success or
failure notification.
If the upgrade was successful, you will receive a successful upgrade notification and can then proceed working with the controller. If the upgrade was unsuccessful, you will receive an unsuccessful upgrade notification with suggested remedial actions to take. |
Verify the upgrade process, see Verifying the Upgrade Process.
You can upgrade to Cisco APIC-EM release 1.2.0.x using the Software Update functionality of the controller's GUI. For upgrading an existing multi-host cluster to Cisco APIC-EM release 1.2.0.x and configure IP Security (IPSec) tunneling for inter-host communications, then you must take additional steps.
Follow the steps described below to upgrade your existing multi-host cluster and configure IPSec tunneling. The steps must be performed in the following order:
Download and update the controller software on one of the hosts (steps 1-5).
Break up or disassemble your multi-host cluster (steps 6-10).
Reboot all the hosts in the multi-host cluster that you just disassembled (step 11).
Configure IPSec tunneling on the last host that was in your cluster (steps 12-16).
Reassembly your multi-host cluster around that last host where you configured IPSec tunneling (steps 17-26).
Note | If you are upgrading to a multi-host cluster from only a single host (not an existing multi-host cluster) and have already updated the single host to release 1.2.0.x, then you need to first reboot that single host and then configure IPSec tunneling using the configuration wizard. After performing this procedure on that single host, when you join any new hosts to form a cluster, you must also first reboot those hosts before joining (if those new hosts were also updated to release 1.2.0.x instead of a fresh Cisco APIC-EM ISO installation). After joining the hosts to form a cluster, each host will have IPSec tunneling configured. |
You must have successfully deployed the Cisco APIC-EM and it must be operational.
You must have received notification from Cisco that the Cisco APIC-EM software upgrade is available to download from the secure Cisco website.
You must have administrator (ROLE_ADMIN) permissions to perform this procedure.
For information about the user permissions required to perform tasks using the Cisco APIC-EM, see the chapter, Managing Users and Roles in the Cisco Application Policy Infrastructure Controller Enterprise Module Configuration Guide.
This procedure should be read with the latest version of the Cisco APIC-EM release notes, as there may be specific additional requirements for that release's upgrade. The latest release for Cisco APIC-EM is release 1.2.0.x. You should first review the Release Notes for Cisco Application Policy Infrastructure Controller Enterprise Module, Release 1.2.0.x before beginning this procedure.
Step 1 | Download the Cisco APIC-EM upgrade package for release 1.2.0.x from the Cisco website at the Download Software link. | ||
Step 2 | Upload the
upgrade package to the controller (one of the hosts in the cluster) using the
Software Update functionality of the GUI.
For additional information about this step, see the Cisco Application Policy Infrastructure Controller Enterprise Module Deployment Guide. | ||
Step 3 | Update the
controller's software with the upgrade package using the
Software Update functionality of the GUI.
For additional information about this step, see the Cisco Application Policy Infrastructure Controller Enterprise Module Deployment Guide. | ||
Step 4 | Check the
controller’s software version number in the GUI
Home window. The GUI
Home window should display the new software version
(1.2.0.x).
| ||
Step 5 | Proceed to
check the software versions of the other hosts in your cluster.
| ||
Step 6 | Using a Secure
Shell (SSH) client, log into one of the hosts in your cluster.
When prompted, enter your Linux username ('grapevine') and password for SSH access. | ||
Step 7 | Enter the
following command to access the configuration wizard.
$ config_wizard | ||
Step 8 | Review the Welcome to the APIC-EM Configuration Wizard! screen and choose the option to remove the host from the cluster: | ||
Step 9 | A message
appears with an option to
[proceed] and remove this host from the cluster.
Choose
proceed>> to begin. After choosing
proceed>>, the configuration wizard begins to
remove this host from the cluster.
At the end of this process, this host is removed from the cluster. | ||
Step 10 | Repeat the
above steps (steps 6-9) on a second host in the cluster.
Make a note of the final host in the cluster that you have just broken up or disassembled. You must perform the next steps (enabling IPSec) on that specific host. For example, if you have 3 hosts in a cluster (A, B , C) and you first remove host A, then remove host B, then you must enable IPSec tunneling on host C. | ||
Step 11 | Prior to
enabling IPSec, reboot each of the hosts in the multi-host cluster that you
just disassembled using the
sudo
reboot command.
$ sudo reboot | ||
Step 12 | Using a Secure
Shell (SSH) client, log into the last host in your cluster and run the
config_wizard command
$ config_wizard | ||
Step 13 | Review the current configuration values in the configuration wizard and click next>>, until you access the INTER-HOST COMMUNICATION screen. | ||
Step 14 | Configure
IPSec tunneling for communications between the hosts in a multi-host cluster by
selecting
yes.
The default tunneling protocol used for communications between the hosts in a multi-host cluster is Generic Routing Encapsulation (GRE). By entering 'yes', you are configuring IPSec tunneling with this step. | ||
Step 15 | Click next>> until the last step of the configuration wizard process is reached. | ||
Step 16 | Click
proceed>> to have the configuration wizard
save and apply your configuration changes to your
Cisco APIC-EM
deployment.
At the end of the configuration process, a CONFIGURATION SUCCEEDED! message appears. Next, proceed to log into the other hosts previously in your multi-host cluster and use the configuration wizard to reassemble the cluster (with secure communications between the hosts). | ||
Step 17 | Using a Secure
Shell (SSH) client, log into one of the other hosts in your cluster.
When prompted, enter your Linux username ('grapevine') and password for SSH access. | ||
Step 18 | Enter the
following command to access the configuration wizard.
$ config_wizard | ||
Step 19 | Review the
Welcome to the APIC-EM Configuration Wizard! screen
and choose the
Create
a new APIC-EM cluster option.
| ||
Step 20 | Proceed to
recreate the cluster using the configuration wizard.
For additional information about this step and process, see the Cisco Application Policy Infrastructure Controller Enterprise Module Deployment Guide . | ||
Step 21 | At the end of
the configuration process, click
proceed>> to have the configuration wizard
save and apply your configuration changes.
A CONFIGURATION SUCCEEDED! message appears. | ||
Step 22 | Using a Secure
Shell (SSH) client, log into the third host and use the configuration wizard to
join the new multi-host cluster.
When prompted, enter your Linux username ('grapevine') and password for SSH access. | ||
Step 23 | Enter the
following command to access the configuration wizard.
$ config_wizard | ||
Step 24 | Review the
Welcome to the APIC-EM Configuration Wizard! screen
and choose the
Add
this host to an existing APIC-EM cluster option.
| ||
Step 25 | Proceed to add
this host to the cluster using the configuration wizard.
For additional information about this step and process, see the Cisco Application Policy Infrastructure Controller Enterprise Module Deployment Guide . | ||
Step 26 | At the end of
the configuration process, click
proceed>> to have the configuration wizard
save and apply your configuration changes.
A CONFIGURATION SUCCEEDED! message appears. At the end of this step, you have updated your multi-host cluster and configured IPSec tunneling. Repeat the above steps to add any additional hosts to your multi-host cluster |
Verify the upgrade process, see Verifying the Upgrade Process.
To verify if an upgrade is successful, do one of the following:
Check the controller's GUI.
After the update, information about it will also appear in the Update History field of the Software Update window. The following update data is displayed in this field:
Date—Local date and time of the update
User—Username of the person initiating the update
Update Version—Update path of release upgrade pack version represented with an arrow.
Update Status—Success or failure status of the update.
Note | If you place your cursor over (mouseover) a failure status in this field, then additional details about the failure is displayed. |
Using a Secure Shell (SSH) client, log into the host (physical or virtual) with the IP address that you specified using the configuration wizard and run the following CLI commands:
grape update history—Displays update history of the controller, including individual task IDs.
grape release display current—Displays the Cisco APIC-EM software release currently running, with services and versions
grape instance display—Displays service instances and versions
grape instance status—Displays service instance status and versions
We also recommend that you run some network tests (for example, discoveries and/or path traces) to ensure that the controller functions as expected and that users are able to authenticate and access the resources on your network.